GoKawiilCritical PHP flaws rated 9.2 severity prompt emergency patch advisory
PHP's maintaining agency disclosed two critical vulnerabilities on Tuesday, with fixes scheduled for release Wednesday at 10 a.m. ET. The flaws, rated 9.2 out of 10 in severity, could let attackers compromise websites built on PHP, which the Wall Street Journal estimates powers 70% of the internet. Agencies including the NSA and UK's NCSC urged administrators to patch immediately or take sites offline, while Cloudflare said it had deployed a firewall fix and security firm watchTowr reported early signs of exploitation attempts.
GoKawiil's interpretation of the reporting above, not reported fact.
The scale of PHP's use means even a narrow technical flaw could have outsized consequences across banking, government and e-commerce sites that rely on it. OpenAI's disclosure that the vulnerabilities were found using its GPT-5.6 Sol model, alongside independent discovery by Wiz, suggests AI tools are increasingly capable of surfacing high-severity bugs, which could reshape how quickly both defenders and attackers find such flaws. The early exploitation attempts watchTowr describes indicate a narrow window between disclosure and real-world attacks, raising pressure on unpatched organizations.
- Two PHP vulnerabilities rated 9.2/10 severity were disclosed, with patches due Wednesday at 10 a.m. ET.
- National security agencies including the NSA and NCSC urged immediate patching or taking affected sites offline.
- AI tools, including OpenAI's GPT-5.6 Sol and Wiz's systems, were credited with independently discovering the flaws.
Source: cnet.com — Katelyn Chedraoui, 2026-10-21
Published there as: “PHP Vulnerabilities Could Put Much of the Internet at Risk, Experts Warn”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.